[change] Limit controller operations on disabled organizations

[nemesifier]

Is your feature request related to a problem? Please describe.

Follow-up of #1338 and #1365, which focused on deactivated devices, but while working on the decision matrix in OpenWISP Device Operation Analysis.ods we also identified several controller operations whose behavior should be tightened for disabled organizations.

A previous broad issue exists in #815, but it is closed and does not contain the actionable matrix details.

Describe the solution you'd like

flowchart TD
    A["Organization Disabled<br/>is_active = False"]

    A --> B["Controller Operation"]

    B --> C["Device Lifecycle"]
    B --> D["Provisioning & Configuration"]
    B --> E["Cleanup & Consistency"]

    C --> C1["BLOCK"]
    D --> D1["BLOCK"]
    E --> E1["ALLOW"]

    C1 --> C2["Registration<br/>Re-registration"]

    D1 --> D2["Template changes<br/>Imports<br/>WHOIS fetches<br/>Location updates<br/>Subnet provisioning<br/>VPN/Server writes<br/>CA renewal"]

    E1 --> E2["Command status broadcasts<br/>Certificate revocation cleanup<br/>VPN peer removal<br/>Subnet cleanup<br/>Cache invalidation"]

    A --> F["Deactivate devices belonging to disabled organization"]

Loading

Implement disabled-organization handling according to the Controller | Decision Matrix sheet, ignoring deactivated-device policy already handled in #1365.

Expected disabled-organization follow-up scope from the matrix:

• Deactivate devices when their organization is disabled.
• Block device registration or re-registration for disabled organizations.
• Keep read-only or cleanup operations allowed when they are needed for consistency, such as command status broadcasts, certificate revocation cleanup, subnet deprovisioning, VPN peer removal, and relevant cache invalidation.
• Skip or block mutating operations for disabled organizations, including template changes, group template application, WHOIS fetches, estimated-location updates, coordinate and location writes, imports, subnet provisioning, certificate checksum updates for device configs, and VPN/server writes that should not apply to disabled organization objects.
• Ensure CA renewal cannot be performed for a disabled organization while preserving the rule that revoked certificates cannot be renewed.

Describe alternatives you've considered

Leaving disabled-organization behavior unchanged would keep these cases inconsistent with the policy already documented in the decision matrix.

[nemesifier]

Cross-reference for the disabled-organization follow-up set:

• [change] Make disabled organizations readonly but deletable openwisp-users#522
• [change] Do not generate notifications for disabled organizations openwisp-notifications#472
• [change] Enforce disabled-organization rules in firmware upgrades openwisp-firmware-upgrader#445
• [change] Enforce disabled-organization rules in monitoring openwisp-monitoring#812
• [change] Enforce disabled-organization rules in RADIUS openwisp-radius#729
• [change] Respect disabled organizations and deactivated devices in topology operations openwisp-network-topology#302